Loading story…
CVE-2023-4966 is a critical, unauthenticated information-disclosure flaw in Citrix NetScaler ADC and NetScaler Gateway, with a CVSS score of 9.4. The vulnerability, known as Citrix Bleed, affects OpenID Connect discovery endpoints: an attacker can send an oversized HTTP Host header to trigger an out-of-bounds memory disclosure.
The flaw stems from improper handling of snprintf return values while constructing a JSON response in a 0x20000-byte static buffer. Exposed process memory can contain valid NSC_AAAC session cookies, enabling attackers to replay stolen tokens and impersonate authenticated users in affected deployments. Citrix issued security guidance and remediated the issue by preventing responses when the generated content exceeds the allocated buffer.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers demonstrated that an oversized HTTP Host header could trigger an out-of-bounds memory disclosure on NetScaler 13.1-48.47. The disclosed memory included valid NSC_AAAC session cookies that could be reused to identify an authenticated user's session in affected configurations.
Citrix addressed the flaw in NetScaler version 13.1-49.15 by checking that snprintf's generated response length is smaller than the allocated 0x20000-byte buffer before sending the response.
Citrix disclosed CVE-2023-4966 as a critical, unauthenticated sensitive-information disclosure flaw in NetScaler ADC and NetScaler Gateway, with a CVSS score of 9.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix multiple vulnerabilities, led by **CVE-2025-5777**, a critical out-of-bounds read flaw dubbed **"Citrix Bleed 2"** because of its similarity to the 2023 Citrix Bleed bug. The vulnerability affects NetScaler deployments used as a Gateway or virtual AAA server and can let a remote unauthenticated attacker read memory, steal sensitive data such as credentials and configuration, hijack sessions, bypass MFA, and potentially gain broader control of affected systems. Citrix and third-party reporting also highlighted **CVE-2025-6543**, a denial-of-service flaw reported as actively exploited, and **CVE-2025-5349**, a high-severity improper access control issue in the NetScaler Management Interface that could allow unauthorized access from the same network segment. Security researchers reported signs consistent with real-world exploitation of **CVE-2025-5777** for initial access, including hijacked Citrix web sessions reused across multiple IP addresses, LDAP-based Active Directory reconnaissance, and use of **ADExplorer64.exe** against multiple domain controllers. Citrix urged administrators to upgrade affected versions immediately, including NetScaler ADC and Gateway `14.1` before `14.1-43.56`, `13.1` before `13.1-58.32`, `13.1-FIPS/NDcPP` before `13.1-37.235-FIPS/NDcPP`, and `12.1-FIPS` before `12.1-55.328-FIPS`, while noting older `12.1` and `13.0` branches are end-of-life. The company also recommended terminating active ICA and PCoIP sessions after patching HA pairs or clusters and monitoring for anomalous HTTP activity associated with session theft.
Sep 3, 2026
Attackers continued to target Citrix NetScaler ADC and NetScaler Gateway systems vulnerable to **`CVE-2025-5777`**, a critical flaw also dubbed **Citrix Bleed 2** that can let unauthenticated attackers obtain sensitive information and hijack user sessions. The vulnerability affects NetScaler deployments configured as described in Citrix’s security bulletin, and public advisories warned that exploitation could also enable arbitrary file reads, broader information disclosure, and denial of service on exposed appliances. SOC telemetry showed exploitation attempts persisted well beyond initial disclosure, with detections recorded from mid-July through September 2025 rather than a brief spike. One observed pattern used a `POST` request to `/p/u/doAuthentication.do` with an unusually long `User-Agent` header to retrieve memory data, while much of the attack traffic was traced to infrastructure in the United States and France. Citrix and national defenders urged organizations to identify affected NetScaler ADC and Gateway versions and apply the vendor’s fixed releases immediately.
Aug 21, 2026